# cPanel, Plesk, and CloudLinux Imunify360 Virtual Patching Guide for Web Hosting Providers

> A practical guide for web hosting providers on deploying CloudLinux Imunify360 WAF rules, updating EasyApache 4, and patching Plesk's internal PHP runtime.

- **Publisher**: Egy Monitor (https://egymonitor.com/en)
- **Original URL**: [https://egymonitor.com/en/posts/cpanel-plesk-cloudlinux-imunify360-php2shell-virtual-patching-guide](https://egymonitor.com/en/posts/cpanel-plesk-cloudlinux-imunify360-php2shell-virtual-patching-guide)
- **Category**: [Web Hosting & Dev](https://egymonitor.com/en/categories/web-hosting-dev)
- **Author**: عبدالرحمن شوقي
- **Published Date**: 2026-10-23 08:52
- **Keywords**: Web Hosting, cPanel, Plesk, CloudLinux, Imunify360

---

Shared and multi-tenant web hosting providers face unique challenges when remediating engine-level vulnerabilities across thousands of customer accounts. A consolidated hosting guide from [24x7ServerManagement](https://24x7servermanagement.com/blog/php2shell-vulnerability-server-security/) and [Plesk Support](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) outlines the exact steps for **cPanel**, **Plesk**, and **CloudLinux** environments.

## What Imunify360 WAF Rules Block—and What They Only Log

CloudLinux shipped emergency Imunify360 WAF rules (including rule v8.84) to block the `session.upload_progress` vector used by public CVE-2026-109619 exploits. However, hosting engineers must note that the out-of-memory path (CVE-2026-109618) is only logged by the WAF, making runtime patching mandatory.

### Step-by-Step Remediation Across Major Hosting Panels

- **Plesk Control Panel:** Patch both the customer-facing PHP handlers (`plesk-php82` through `plesk-php85`) AND Plesk's own internal GUI PHP binary.
- **cPanel EasyApache 4 & Alt-PHP:** Run `yum update ea-php*` and `yum update alt-php*`, then restart Apache, LiteSpeed, and CageFS.
- **SiteHost & Container Hosts:** As [SiteHost](https://sitehost.nz/blog/urgent-php-fixes-2026) demonstrated, globally disabling `session.upload_progress.enabled` in base templates reduces immediate exposure during rollout.

> Be aware that ImunifyAV/AV+ without an active WAF module receives zero virtual-patching protection—updating the PHP binary is non-negotiable.

## Handling Cross-Site Upload Breakage From WAF Rule 8.84

If a customer site relies on legitimate cross-domain file upload forms that break under Rule 8.84, upgrade that account's PHP runtime to 8.3.36 or 8.4.27 first before whitelisting the specific domain.

### Verifying CageFS Skeleton Updates

On CloudLinux servers using CageFS, run `cagefsctl --force-update` after package upgrades so isolated tenant containers see the patched binaries. Full primary documentation is available via [24x7ServerManagement Hosting Security Guide](https://24x7servermanagement.com/blog/php2shell-vulnerability-server-security/).